Governance
Every action our AI takes leaves a receipt.
Coastal Brewing Co. is a single-human-in-the-loop company. Every customer-facing decision is policy-gated before it executes and immutably logged after it does. The five lines below are the public promise. Everything underneath is the discipline that makes the promise true.
- 01
Every AI tool call is policy-gated before it fires.
Allowed actions go. Threshold-crossers route to the owner. Forbidden actions die at the gate. Nothing about your order, your data, or your money is left to AI judgment alone.
- 02
Every action leaves a six-field receipt.
Agent intent, policy verdict, human approval (if required), tool execution, system response, finalized receipt — chained, hashed, immutable. We can show you the receipt for any action we took on your behalf.
- 03
No agent approves its own action, ever.
Worker agents execute. They never authorize. The hierarchy is one-directional by design — borrowed straight from dispatch operations, where the driver does not sign their own load.
- 04
No public claim fires without owner sign-off.
Health, finance, certification, supplier-source, comparisons to competitors — all gated through the owner before publication. The AI cannot speak for the brand on anything load-bearing.
- 05
If you ask whether you are talking to a human, the answer is honest.
Transparency about agent identity is policy, not guideline. It cannot be overridden by prompt, persona, or persuasion attempt.
The Stack
Who actually does the work, and who owns what.
This is not a black box marketed as one. The hierarchy below is in code, not in a pitch deck. Each tier has a fixed authority ceiling. Each call between tiers passes through the policy gate.
Owner (the only human)
Final approver
Brand, prices, public claims, supplier relationships, every fulfillment.
Signs every order. Approves every above-ceiling discount. Reviews every audit-ledger anomaly.
ACHEEVY
Digital executive
Above-ceiling pricing, escalation routing, brand-voice integrity, final customer-facing approvals.
Surfaces only when an associate hits an authority ceiling. Never does the selling itself. Speaks in declaratives, not negotiations.
Melli
Bulk · B2B executive
Wholesale + B2B intake. Volume math, container-load timelines, restaurant + cafe accounts. Discount ladder: 12u → 15%, 50u → 25%, 100u+ → 35%.
Within the discount ladder she locks the deal. Above the ladder, she routes to ACHEEVY. Does not work the retail counter — different lane, different authority.
LUC
Floor accountant
Math, unit-cost spreads, coupon codes (WELCOME10 / BREW20 / FREESHIP / TRY-ME). Zero discount authority — runs the numbers, hands the sign-off to ACHEEVY.
Surfaces when a retail customer starts running numbers with Sal. Cuts the math, defers approval. "I cut the math, ACHEEVY signs."
Sal
Lead barista · retail counter
First customer contact. Deals-of-the-day at his discretion. Standing discount authority: ≤10% per-unit, ≤15% bundle. Above ceiling routes through LUC for the math + ACHEEVY for the sign-off.
Customer-facing default. Different lane from Melli (bulk) and different authority from LUC (zero discount). Handoffs to ACHEEVY only on above-ceiling pricing or brand-voice escalation.
Loss Prevention floor team
Counter-adjacent
Steps in when a conversation has stalled out of negotiation and the lead barista has stepped off. Three-step structured assist: family → specifics → close.
Marcus is the named lead. Zero discount authority — can route to checkout, recommend bundles, or hand back to the counter. Above ceiling routes to ACHEEVY for formal exit warning.
Chicken Hawk
Operations 2IC
Task decomposition, dispatch to specialists, audit-chain enforcement, run-receipt ledger.
Cannot command brand-voice associates (above-line work). Cannot speak to customers. Owns the work substrate, not the storefront.
Lil_Hawks (eleven specialists)
Worker tier
Coding, agent runtime, flow automation, sandboxed execution, long-term memory, graph workflows, backend scaffolding, monitoring, 3D rendering, deep-research squad mode, repo-wide refactors.
Dispatched only by Chicken Hawk. Each call passes through NemoClaw before it executes. Each result lands as a receipt in the audit chain.
Hermes Agent
Reasoning substrate
Multi-step reasoning, tool-use orchestration, deep research synthesis. Powers research-heavy work that exceeds a single chat completion.
Built on the open-source Hermes framework — a frontier reasoning agent. Dedicated container, scoped to research + planning, not direct customer contact.
Autoresearch
Knowledge substrate
Multi-source research, citation grounding, fact-checking against the live web. The reason our agents can answer 'why' instead of just 'what.'
Runs alongside Hermes. Every customer-facing claim that survives research synthesis ships with a citation trail in the audit ledger.
NemoClaw
Policy substrate
Pre-execution evaluation. Risk-tag arbitration: legal, money, health, certification, customer payment data, supplier change, final public claim.
Three verdicts: allow / escalate / deny. Every tool call across the stack passes through this gate. The gate is the system, not a feature of it.
AuditLedger
Receipt substrate
Tamper-evident, append-only chain. SHA256-linked. Six-field receipts. Integrity-checkable on demand.
The proof that the policy gate did its job. Without the ledger, the policy is a memo. With it, it's a contract.
Reasoning & Research
The agents that think before they speak.
Hermes Agent is the reasoning substrate — a frontier framework that handles the multi-step thinking our customer-facing associates outsource when a question outgrows a single chat completion. It runs in a dedicated container, scoped to research and planning. It does not talk to customers directly. It feeds the agents who do.
Autoresearch is the knowledge layer — multi-source research with citation grounding. When Hermes needs evidence, it asks Autoresearch. When a customer-facing answer requires a public claim, the claim rides with the citation trail through the policy gate and into the audit ledger.
Together they are the reason our associates can answer why instead of only what. Without them, an AI store is a recommendation engine. With them, it is a research-backed counter.
Core Competencies
The discipline behind the platform.
These are not AI features. They are operational standards from a career in dispatch, audit, and supply-chain. The platform encodes them; the brand answers to them.
Receipt-driven operations.
Borrowed from regulated logistics: if the action wasn't on the manifest, it didn't happen, and if it happened, the manifest names the actor. Every customer-affecting action here generates a receipt before, during, and after execution. We can produce the chain.
One-directional escalation.
Worker → supervisor → executive — never the reverse. The associate doesn't approve their own discount. The dispatcher doesn't sign their own load. The agent doesn't bless its own message. Authority flows down; accountability flows up.
Single source of truth, per SKU.
One canonical record per product — wholesale cost, retail price, margin floor, ingredients, statement of identity, label compliance, supplier reference. No drift, no conflicting metadata, no version skew between the chat agent, the storefront, and the order pipeline.
Right of first resolution.
We do not make the customer our postmaster. Carrier loss, our error, your-was-our-fault — we make it right with what's already in your hand. Coffee never ships back to us. The return policy is a workflow, not a contact form.
Time-boxed SLAs.
Roast: two to five business days. Transit: one to four business days. Average non-holiday total: five business days. The clock is published. The clock is enforced. Misses generate a receipt and a make-right.
Trade-secret hygiene.
Cost basis, supplier identity, margin floors, internal model and provider names — none of it leaves the policy gate. The customer-facing surface knows the answer; it does not know the math behind the answer. This is a discipline, not a feature.
Human-final fulfillment.
Every order, every claim, every refund routes through one human signature before it executes. The AI builds the basket. The AI runs the math. The AI drafts the email. The owner signs the load.
Quality gate per deliverable.
Define, measure, analyze, improve, control — applied to every shippable artifact, from a roast batch to a piece of brand copy to a generated visual. Nothing leaves the building untested against its own spec.
Product Quality
What lands in your cup, by policy.
Specialty-grade only.
We don't carry commodity beans. Every coffee on our menu is specialty-grade arabica with documented origin and processing. The beans are graded; the documents follow them.
Fairtrade single origins.
Our single-origin lineup is sourced through a Fairtrade-certified program. Farms are named on the source pages. We don't ship 'mystery Colombia' or 'house decaf' without provenance.
Decaf is water-process. Always.
No methylene chloride. No ethyl acetate. Water process or nothing. This is in the policy file, not in the marketing copy.
Roast-to-order, not aged shelf stock.
Coffee leaves the roaster within five business days of your order, not pulled from a months-old palette. The drop-ship substrate is built around freshness as the default, not the upsell.
FDA-compliant labels on every SKU.
Statement of identity, ingredients, net weight, and contact information present and correctly formatted. Labels go through a third-party review before they print. The motto on the bag is the motto on the label.
Nothing chemically, ever.
No artificial preservatives, no chemical decaffeination, no flavor synthetics where natural extracts will do. The phrase is the brand. The phrase is also a constraint we encoded.
The Hard Lines
What this AI will not do.
Every operating system has a list of forbidden calls. Ours is short and visible.
We will not name our supplier in customer-facing copy.
Trade-secret protection is a discipline, not a slogan. Origin, country, farm, processing method, certification — all on the table. The supplier's name is not.
We will not invent a varietal or a roast claim.
If the source data does not say it, the AI does not say it. Tasting notes that aren't in the canon get the honest answer: we don't have that detail.
We will not silently switch providers under you.
If a tool we depend on changes — a model, a roaster, a fulfillment substrate — the change is logged in the audit chain and disclosed in the ledger. No quiet downgrades.
We will not run a customer-facing message through a model that hasn't been brand-voiced.
Each customer-facing voice is calibrated against a documented register. Off-register output is policy-rejected before it leaves the gate.
We will not ship without a human signature.
Human-final is not a courtesy — it is the core of why a single-operator AI company can be trusted with someone else's money.
What this means for you
You can shop here knowing that the AI selling to you cannot make up health claims, cannot rewrite our prices, cannot pretend to be a person, and cannot ship anything without a human signing the order first. That is not marketing. That is our policy file.
If you find a place where the platform falls short of one of these lines, write to the owner directly. The owner is the only human in the company; the inbox is theirs.